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AMENDMENTS TO THE CLAIMS 

1 1 . (CURRENTLY AMENDED) A computer-implemented method for executing an 

2 untrusted program, comprising: 

3 establishing a limited environment within a general environment , wherein said 

4 limited environment comprises comprising at least one mock resource , wherein said general 

5 environment comprises at least one real resource, and wherein said limited environment and 

6 said general environment are both implemented using the same type of operating system ; 

7 executing at least a portion of an untrusted program within said limited environment; 

8 and 

9 examining said limited environment after execution of at least said portion of said 
10 untrusted program to check for undesirable behavior exhibited by said untrusted program. 

1 2. (ORIGINAL) The method of claim 1, where said limited environment precludes 

2 access to actual resources, which if altered or accessed by said untrusted program, may lead 

3 to undesirable consequences. 

1 3. (ORIGINAL) The method of claim 1 , wherein said limited environment comprises a 

2 shell in a UNIX operating system environment. 

1 4. (ORIGINAL) The method of claim 1, wherein examining said mock environment 

2 comprises: 

3 determining whether said mock resource has been deleted. 

1 5. (ORIGINAL) The method of claim 1, wherein examining said mock environment 

2 comprises: 



P5373 



Attorney Docket No. 15437-0508 



3 determining whether said mock resource has been renamed. 

1 6. (ORIGINAL) The method of claim 1, wherein examining said mock environment 

2 comprises: 

3 determining whether said mock resource has been moved. 

1 7. (ORIGINAL) The method of claim 1, wherein examining said mock environment 

2 comprises: 

3 determining whether said mock resource has been altered. 

1 8. (ORIGINAL) The method of claim 7, wherein said mock resource has a parameter 

2 associated therewith which changes when said mock resource is altered, and wherein 

3 determining whether said mock resource has been altered, comprises: 

4 determining whether said parameter has changed. 

1 9. (ORIGINAL) The method of claim 8, wherein said parameter is a time value 

2 indicating when said mock resource was last updated. 

1 10. (ORIGINAL) The method of claim 1, wherein examining said mock environment 

2 comprises: 

3 determining whether said mock resource has been accessed. 

1 11. (ORIGINAL) The method of claim 10, wherein said mock resource contains one or 

2 more sets of content, wherein said untrusted program executes in a particular portion of 

3 memory, and wherein determining whether said mock resource has been accessed 

4 comprises: 
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5 searching said particular portion of said memory for at least one of said one or more 

6 sets of content. 

1 12. (ORIGINAL) The method of claim 1, further comprising: 

2 providing information indicating behavior exhibited by said untrusted program. 

1 13. (ORIGINAL) The method of claim 12, wherein said information comprises 

2 indications of undesirable behavior exhibited by said untrusted program. 

1 14. (ORIGINAL) The method of claim 1, further comprising: 

2 determining whether said untrusted program has exhibited undesirable behavior; and 

3 in response to a determination that said untrusted program has exhibited undesirable 

4 behavior, taking corrective action. 

1 15. (ORIGINAL) The method of claim 1 4, wherein taking corrective, action comprises : 

2 deleting said untrusted program. 

1 16. (ORIGINAL) The method of claim 14, wherein taking corrective action comprises: 

2 providing a warning to a user. 

1 1 7. (CURRENTLY AMENDED) A computer readable medium comprising instructions 

2 which, when executed by one or more processors, cause the one or more processors to 

3 execute an untrusted program, said computer readable medium comprising: 

4 instructions for causing one or more processors to establish a limited environment 

5 within a general environment , wherein said limited environment comprises comprisin g at 

6 least one mock resource , wherein said general environment comprises at least one real 
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7 resource, and wherein said limited environment and said general environment are both 

8 implemented using the same type of operating system ; 

9 instructions for causing one or more processors to execute at least a portion of an 

10 untrusted program within said limited environment; and 

1 1 instructions for causing one or more processors to examine said limited environment 

12 after execution of at least said portion of said untrusted program to check for undesirable 

13 behavior exhibited by said untrusted program. 

1 18. (ORIGINAL) The computer readable medium of claim 17, where said limited 

2 environment precludes access to actual resources, which if altered or accessed by said 

3 untrusted program, may lead to undesirable consequences. 

1 1 9. (ORIGINAL) The computer readable medium of claim 1 7, wherein said limited 

2 environment comprises a shell in a UNIX operating system environment. 

1 20. (ORIGINAL) The computer readable medium of claim 17, wherein said instructions 

2 for causing one or more processors to examine said mock environment comprises: 

3 instructions for causing one or more processors to determine whether said mock 

4 resource has been deleted. 

1 21. (ORIGINAL) The computer readable medium of claim 1 7, wherein said instructions 

2 for causing one or more processors to examine said mock environment comprises: 

3 instructions for causing one or more processors to determine whether said mock 

4 resource has been renamed. 
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1 22. (ORIGINAL) The computer readable medium of claim 17, wherein said instructions 

2 for causing one or more processors to examine said mock environment comprises: 

3 instructions for causing one or more processors to determine whether said mock 

4 resource has been moved. 

1 23. (ORIGINAL) The computer readable medium of claim 17, wherein said instructions 

2 for causing one or more processors to examine said mock environment comprises: 

3 instructions for causing one or more processors to determine whether said mock 

4 resource has been altered. 

1 24. (ORIGINAL) The computer readable medium of claim 23, wherein said mock 

2 resource has a parameter associated therewith which changes when said mock resource is 

3 altered, and wherein said instructions for causing one or more processors to determine 

4 whether said mock resource has been altered, comprises: 

5 instructions for causing one or more processors to determine whether said parameter 

6 has changed. 

1 25. (ORIGINAL) The computer readable medium of claim 24, wherein said parameter is 

2 a time value indicating when said mock resource was last updated. 

1 26. (ORIGINAL) The computer readable medium of claim 17, wherein said instructions 

2 for causing one or more processors to examine said mock environment comprises: 

3 instructions for causing one or more processors to determine whether said mock 

4 resource has been accessed. 
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1 27. (ORIGINAL) The computer readable medium of claim 26, wherein said mock 

2 resource contains one or more sets of content, wherein said untrusted program executes in a 

3 particular portion of memory, and wherein said instructions for causing one or more 

4 processors to determine whether said mock resource has been accessed comprises: 

5 instructions for causing one or more processors to search said particular portion of. 

6 said memory for at least one of said one or more sets of content. 

1 28. (ORIGINAL) The computer readable medium of claim 17, further comprising: 

2 instructions for causing one or more processors to provide information indicating 

3 behavior exhibited by said untrusted program. 

1 29. (ORIGINAL) The computer readable medium of claim 28, wherein said information 

2 comprises indications of undesirable behavior exhibited by said untrusted program. 

1 30. (ORIGINAL) The computer readable medium of claim 17, further comprising: 

2 instructions for causing one or more processors to determine whether said untrusted 

3 program has exhibited undesirable behavior; and 

4 instructions for causing one or more processors to, in response to a determination 

5 that said untrusted program has exhibited undesirable behavior, take corrective action. 

1 31. (ORIGINAL) The computer readable medium of claim 30, wherein said instructions 

2 for causing one or more processors to take corrective action comprises: 

3 instructions for causing one or more processors to delete said untrusted program. 
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1 32. (ORIGINAL) The computer readable medium of claim 30, wherein said instructions 

2 for causing one or more processors to take corrective action comprises: 

3 instructions for causing one or more processors to provide a warning to a user. 

1 33. (NEW) The method of claim 1, wherein said limited environment and said general 

2 environment are both implemented on the same machine. 

1 34. (NEW) The computer readable medium of claim 17, wherein said limited 

2 environment and said general environment are both implemented on the same machine. 

1 35. (NEW) The method of claim 1 , wherein said limited environment and said general 

2 environment are both implemented on the same machine and using the same operating 

3 system. 

1 36. (NEW) The computer readable medium of claim 17, wherein said limited 

2 environment and said general environment are both implemented on the same machine and 

3 using the same operating system. 
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